CVE-2026-92028: Firefox Use-After-Free Vulnerability

CVE-2026-92028 Overview

CVE-2026-92028 is a use-after-free memory corruption vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. The flaw affects how the browser engine manages object lifetimes within Document Object Model (DOM) operations. Mozilla addressed the issue in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability was disclosed through Mozilla Foundation Security Advisories MFSA-2026-90 through MFSA-2026-96.

Critical Impact
Successful exploitation of a DOM use-after-free can lead to arbitrary code execution within the browser content process, enabling drive-by attacks from a malicious web page.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 115.41, 140.16, and 153.3
Mozilla Thunderbird versions prior to 156, 140.16, and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92028 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92028

Vulnerability Analysis

The vulnerability resides in the DOM: Core & HTML component, which manages the in-memory representation of HTML documents inside Gecko. A use-after-free condition occurs when code continues to reference a heap object after it has been released. In a browser DOM context, script-driven manipulation of nodes, ranges, or event listeners can trigger the premature destruction of an object while another code path still holds a pointer to it.

When the freed memory is reallocated and populated with attacker-controlled data, subsequent dereferences operate on that data. This class of flaw typically enables memory disclosure, control-flow hijacking, or sandboxed content-process compromise. The affected component is reachable from any web content, making the attack surface broad across normal browsing sessions and HTML-rendered email in Thunderbird.

Root Cause

The root cause is improper object lifetime management within DOM Core and HTML handling code. A reference to a DOM object persists beyond the object's deallocation, violating memory safety invariants. See Mozilla Bug Report #2068440 for the tracking entry.

Attack Vector

Exploitation requires a victim to load an attacker-controlled HTML document in a vulnerable Firefox or Thunderbird build. Thunderbird is affected when rendering HTML mail, though scripting is disabled by default in mail contexts, which reduces but does not eliminate risk. Refer to MFSA-2026-90 through MFSA-2026-96 for advisory-level detail.

No public proof-of-concept or exploit code has been published for CVE-2026-92028 at the time of writing.

Detection Methods for CVE-2026-92028

Indicators of Compromise

Unexpected crashes of firefox.exe, firefox-bin, or thunderbird processes with access violation or SIGSEGV signatures during web content rendering.
Content-process child instances spawning unexpected child processes such as command shells, script interpreters, or powershell.exe.
Outbound network connections from browser processes to previously unseen domains immediately after visiting an untrusted page.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across managed endpoints and flag builds older than the fixed versions listed in the Mozilla advisories.
Monitor for browser process crash telemetry correlated with visits to low-reputation domains or freshly registered infrastructure.
Apply behavioral rules that detect browser processes executing living-off-the-land binaries or writing executable files to user-writable paths.

Monitoring Recommendations

Ingest browser crash reports and EDR process telemetry into a centralized data lake for retrospective hunting.
Track patch compliance for Firefox 156, Firefox ESR 115.41 / 140.16 / 153.3, and Thunderbird 156 / 140.16 / 153.3 in vulnerability management dashboards.
Alert on Thunderbird spawning child processes, which is anomalous under normal mail workflows.

How to Mitigate CVE-2026-92028

Immediate Actions Required

Update Firefox to version 156 or the appropriate ESR release (115.41, 140.16, or 153.3).
Update Thunderbird to version 156, 140.16, or 153.3 depending on your deployed branch.
Restart browser and mail client processes after patching to ensure the vulnerable code is unloaded from memory.

Patch Information

Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. Consult the Mozilla Security Advisory MFSA-2026-90 and the companion advisories MFSA-2026-91 through MFSA-2026-96 for release-specific details.

Workarounds

Disable JavaScript on untrusted sites using a content-blocking extension until patching is complete.
Configure Thunderbird to render messages as plain text to reduce exposure from HTML mail.
Restrict browsing on unpatched hosts to a known-good allowlist enforced via a secure web gateway.

bash

# Configuration example: verify installed Firefox version on Linux endpoints
firefox --version
# Expected output for a patched build: "Mozilla Firefox 156.0" or newer ESR